Exploit for CVE-2025-49493

Akamai CloudTest XXE Exploit CVE-2025-49493 Overview Th...

CVE-2025-53689: Improper Restriction of XML External Entity Reference

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

Akamai CloudTest XML Injection

This is a Python-based exploit for CVE-2025-49493, which affects Akamai CloudTest versions before 60 2025.06.02 12988. The vulnerability allows for XML External Entity XXE injection through the SOAP service endpoint...

Apache Jackrabbit 安全漏洞

Apache Jackrabbit is a content repository from Apache Corporation USA. A security vulnerability exists in Apache Jackrabbit versions prior to 2.23.2, which stems from a blind XXE vulnerability in jackrabbit-spi-commons and jackrabbit-core...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-7523

A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-7523 Jinher OA DelTemp.aspx xml external entity reference

A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-7523

CVE-2025-7523 affects Jinher OA 1.0. The vulnerability is an XML External Entity (XXE) reference issue in the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx that can be triggered remotely. Multiple sources confirm the flaw and public disclosure of the exploit. No concrete fix/version is provide...

CVE-2025-7523 Jinher OA DelTemp.aspx xml external entity reference

A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

The vulnerability of the ColdFusion software platform lies in the improper limitation on XML references to external objects, which allows attackers to circumvent security restrictions.

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

Jinher OA 代码问题漏洞

Jinher OA is a collaborative management software from Jinher, China. A code issue vulnerability exists in Jinher OA version 1.0, which originates from an incorrect operation of file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx resulting in an XML external entity reference...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-6438

Schneider Electric EcoStruxure IT Data Center Expert (prior to 9.0; affected versions 8.3 and earlier) is affected by CVE-2025-6438: XML External Entity (XXE) injection via the DataExchange SOAP route, enabling unauthenticated or low-privilege exploitation to read local files and potentially caus...

Malicious code in grallama (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9a320b2690b732632ebf0fc3d95fb5e7b73a3da0fa8a36714880645805464c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dradis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7954d52cb9efed1e6bca698b7419519943e5bfd49e00332c59356fef7afe6cf0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-49535

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service b...

CVE-2025-49544

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or...

Malicious code in dt-automation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6eeff9a72134c244b969bcd674f473359fea30bfe4423298194db75e255a238 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...